I am in the process of setting up an api which will have the subdomain "api.", I have been advised to change this to something "less obvious" to avoid automated attacks against it. I can't find any advice on naming subdomains to avoid attacks and from a business perspective the benefit of this approach is alerting non-tech professionals that we have an api.

Is this legitimate advice which I should seriously consider or is this something that will yield little to nothing in the way of security?


This is something that will yield little to nothing in the way of security.

The subdomain will still be leaked:

  • In your client that uses the API. To connect to the API the client has to have the correct URL, and someone with the client can extract this URL.
  • In plaintext traffic when using SNI (Server Name Indication). The subdomain is sent plain text before setting up an encrypted connection, in most cases.
  • In certificate transparency logs. If you request a HTTPS certificate for your domain, the domainname will end up in a public log.
  • Thanks, I felt it wouldn't improve security much but it's always nice to double check. I appreciate your help – Mike Mar 21 at 9:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.